[OR] [P1-S3] Setting Operational Resilience Vision and Strategy

Setting the OR Vision and Strategy for a Financial Institution

In today’s increasingly complex and interconnected financial landscape, operational resilience (OR) has become a critical priority for Financial Institutions (FIs).

Operational resilience refers to an FI’s ability to prevent, adapt, respond to, recover from, and learn from operational disruptions while delivering critical customer service.

A clear OR vision and strategy are essential for banks to build a robust framework that ensures continuity, protects customers, and maintains trust in the financial system.

This article explores the importance of setting an OR vision and strategy, provides examples of what these might look like for an FI, and outlines the key components of a successful OR framework.

The Importance of an OR Vision and Strategy

An OR vision and strategy are the foundation for an FI’s approach to managing operational risks and disruptions.

They provide a clear direction, align stakeholders, and ensure the organization is prepared to handle various potential disruptions, including cyberattacks, IT failures, natural disasters, and geopolitical events.

OR Vision

The vision articulates the bank’s long-term aspirations for operational resilience. It reflects the organisation’s commitment to safeguarding critical services, protecting customers, and maintaining financial stability.

OR Strategy

The strategy outlines the actionable steps, resources, and governance structures required to achieve the vision.

It defines how the FI will identify critical services, set impact tolerances, test resilience, and continuously improve its capabilities.

The vision and strategy ensure that operational resilience is embedded into the FI’s culture, processes, and decision-making.

Example of an OR Vision for an FI

A well-crafted OR vision is aspirational, customer-focused, and aligned with the bank’s mission. Below is an example of an OR vision for an FI:

"To be a trusted and resilient financial institution that ensures the uninterrupted delivery of critical services to our customers, even in the face of significant disruptions.

We will achieve this by embedding resilience into our culture, investing in advanced technologies, and fostering collaboration across our organisation and with external partners.

Our commitment to operational resilience will safeguard our customers, protect the financial system, and uphold the trust placed in us by our stakeholders."

This vision emphasizes the bank’s dedication to customer protection, trust, and continuous improvement while highlighting the importance of collaboration and innovation.

Example of an OR Strategy for an FI

In the context of BCM Institute's training requirement, it is usually extracted from the key stages of the three phases of the Operational Resilience Planning Methodology.

In most cases, it is driven by the demand from the respective central banks and regulators.

It typically includes the following components [Phase-Stage] of the OR planning methodology:

[P2-S1] Identification of Critical Business Services

Define the services essential to customers and the financial system (e.g., payment processing, online banking, and ATM services).
Example: The FI identifies payment processing as a critical service because it directly impacts customers and is systemic in importance.

[P2-S3] Setting Impact Tolerances

Establish the maximum acceptable level of disruption for each critical service (e.g., downtime, financial loss, customer impact).
Example: The FI sets an impact tolerance of no more than 2 hours of downtime for payment processing during a disruption.

[P2-S2] Risk Assessment and Mapping

Identify potential threats and vulnerabilities that could disrupt critical services.
Example: The FI conducts a risk assessment and identifies cyberattacks, third-party failures, and natural disasters as key threats.

[P2-S4] Resilience Testing and Scenario Planning

Develop and test scenarios to assess the bank’s ability to withstand and recover from disruptions.
Example: The bank conducts a simulated cyberattack scenario to test its incident response and recovery capabilities.

[P1-S3] Investment in Technology and Infrastructure

Allocate resources to enhance IT systems, data security, and backup solutions.
Example: The FI invests in cloud-based infrastructure to ensure data redundancy and rapid recovery.

[P2-S1] Third-Party Risk Management

Ensure that third-party vendors and partners meet the FI’s resilience standards.
Example: The FI requires all vendors to undergo regular resilience assessments and provide evidence of their contingency plans.

[P1-S5] Governance and Accountability

Establish clear roles and responsibilities for OR across the organization.
Example: The FI appoints a Chief Resilience Officer (CRO) to oversee the OR program and report to the board.

[P2-S5] Continuous Improvement

Regularly review and update the OR strategy based on lessons learned from disruptions and evolving risks.
Example: The FI conducts quarterly reviews of its OR framework and incorporates stakeholder feedback.

Key Components of a Successful OR Framework

To effectively implement the OR vision and strategy, FIs should focus on the following key components:

Leadership Commitment: Senior management and the board must champion operational resilience and allocate the necessary resources.
Customer-Centric Approach: Prioritise protecting customer interests and ensure minimal disruption to critical services.
Collaboration: Foster collaboration across business units, regulators, and external partners.
Data-Driven Decision-Making: Leverage data and analytics to identify risks, monitor performance, and drive improvements.
Regulatory Compliance: Align the OR strategy with regulatory requirements and expectations.
Culture of Resilience: Embed resilience into the organization’s culture through training, awareness, and accountability.

Summing Up ...

Setting a clear OR vision and strategy is essential for FIs to navigate the complexities of the modern financial environment.

By articulating a compelling vision and developing a comprehensive strategy, FIs can build the resilience to withstand disruptions, protect customers, and maintain trust.

The examples provided in this article illustrate how a bank can define its OR vision and strategy and ensure that operational resilience becomes a core part of its operations and culture.

In an era of increasing uncertainty, banks prioritising operational resilience will safeguard their future and contribute to the stability and reliability of the global financial system.

A robust operational resilience strategy enables financial institutions to navigate uncertainty and thrive in a dynamic environment.

More Information About Blended Learning OR-5000 [BL-OR-5] or OR-300 [BL-OR-3]

To learn more about the course and schedule, click the buttons below for the OR-3 Blended Learning OR-300 Operational Resilience Implementer course and the OR-5 Blended Learning OR-5000 Operational Resilience Expert Implementer course.